The toolkit says: Azure AD SAML Toolkit supports SP initiated SSO
I have searched for IDP initiated examples, but the examples I find no longer are relevant. I was hoping to use the toolkit, but it doesn't appear to allow this. Can anyone please advise? The Single Sign On option that is in some examples no longer exists in Azure. Thanks!
There aren't any.
IDP Initiated is started by the IDP and so is "built-in".
As the doc. states:
"Sign-on URL Required Don't specify
When a user opens this URL, the service provider redirects to Azure AD to authenticate and sign on to the user. Azure AD uses the URL to start the application from Microsoft 365 or Azure AD My Apps.
When blank, Azure AD does an IdP-initiated sign-on when a user launches the application from Microsoft 365, Azure AD My Apps, or the Azure AD SSO URL".
Related
We have a requirement to integrate ADB2C with OKTA as an external Identity Provider.
OKTA will hold the External users and these users needs to access the applications hosted on Azure.
How do I implement the Integration between AAD B2C and OKTA ?
Thanks for posting your query. In order to integrate OKTA as IDP, kindly follow: https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-generic-saml?tabs=windows&pivots=b2c-custom-policy. It has to be added as a SAML IDP
You can configure Azure AD B2C to allow users to sign in to your application with credentials from external social or enterprise SAML identity providers (IdP). When Azure AD B2C federates with a SAML identity provider, it acts as a service provider initiating a SAML request to the SAML identity provider, and waiting for a SAML response. In the following diagram:
The application initiates an authorization request to Azure AD B2C.
The application can be an OAuth 2.0 or OpenId Connect application, or
a SAML service provider.
In the Azure AD B2C sign-in page, the user chooses to sign-in with a SAML identity provider account (for example, Contoso). Azure AD B2C
initiates a SAML authorization request and takes the user to the SAML
identity provider to complete the sign-in.
The SAML identity provider returns a SAML response. Azure AD B2C validates the SAML token, extracts claims, issues its own token, and
takes the user back to the application.
Yes, Azure Active Directory B2C has a free tier for your first 50,000 active users per month (MAU), which you can use for testing purposes. https://azure.microsoft.com/en-in/trial/get-started-active-directory-b2c/
Log in to the Azure portal by using your existing Azure subscription or by starting a free trial. On the left side, click on the New button and search for B2C. Click Create.
Click Create a new Azure AD B2C tenant and fill in all the fields.
Once you are ready click Create and wait for creation of your
directory to finish.
Once your directory is created, a prompt will appear notifying you
your new directory is ready. Click on the link in the prompt to
access your new directory.
The B2C settings blade appears, where you configure and manage your
Azure Active Directory B2C directory.
Thanks
We have a public consumer application for which we use Auth0 as identity platform and through Auth0 we have enabled a couple of social logins to which we now want to add "Login with Microsoft" as an option so that anyone with any type of Microsoft account can login.
Obviously we will need to enable the Microsoft social connection in our Auth0 instance and connect it to a Active Directory Application and Tenant created in Azure.
What I can't seem to find the answer for is which type of tenant we should setup for this, whether we should use a Azure Active Directory tenant with a multi-tenant application or if we should use a Azure Active Directory (B2C) tenant for this?
Thanks for posting your query. As per https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/azure-active-directory/v2#register-your-app-with-azure-ad Azure AD would support for multitenant apps but not with social account (until you plan to send invitation to each user's personal account for Azure AD B2B).
For Microsoft Social accounts Azure B2C would suit your requirement.
On Auth0 Admin Console:
Create a web application in Auth0
Copy the client ID and secret
Add a callback URL from your B2C tenant in given format: https://.b2clogin.com/.onmicrosoft.com/oauth2/authresp
Copy the “OpenID Configuration” URI from advance setting.
On Azure B2C tenant:
Add an Identity provider to B2C, Azure AD B2C > Identity providers > New OpenID Connect Provider
Input “OpenID Configuration” URI you copied in above step to Metadata URL.
Similarly add client ID and Client secret you copied from Auth0.
Complete the claims mapping ref: https://learn.microsoft.com/en-in/azure/active-directory-b2c/identity-provider-generic-openid-connect?pivots=b2c-user-flow#claims-mapping
Hit Save and Auth0 will be saved as IDP in your Azure B2C tenant.
Thanks
I've gathered the following insights since posting my question
Summary
Auth0 Social connection -> Azure Active Directory tenant with an app configured to support "Personal Microsoft accounts"
Auth0 Enterprise connection -> Azure Active Directory tenant with an app configured to support "Accounts in any organisational directory and personal Microsoft accounts"
See guide of different app types here
Details
Since we wanted to support login with any microsoft account (multi tenant + personal) my initial attempt of using an Auth0 Social connection for this was incorrect, since the Social connection will only allow successful logins with personal accounts regardless of how you have setup the App registration in Azure
Auth0 Enterprise connection is the way to go for our case, with an Azure app registation supporting multi tenant + personal accounts. Also when setting the connection up in Auth0, make sure to enable the "Use common endpoint" setting as described here
The Azure Active Directory B2C tenant type is not useful with any of the Auth0 connections as you likely won't be able to get a satisfying consent screen with verified publisher. I'm guessing its just the wrong way of using the B2C tenant, where its supposed to be used the other way around with the Azure tenant being the identity platform optionally integrating applications from Auth0 like in the answer from Mavric20
Website webapp1.com has registered users with its own IdP implementation.
There are other websites such as webapp2.com, webapp3.com, webapp4.com (different domain).
A logged-in-user user1 of webapp1.com wants to do a SSO login to webapp2.com or webapp3.com or webapp4.com.
user1 has accounts in webapp2.com/webapp3.com/webapp4.com as well.
Is there a way to implement this using Azure AD or Azure AD B2C?
This is possible using PingIdentity.
https://www.pingidentity.com/en/resources/blog/posts/2021/sso-vs-federated-identity-management.html
Tried Azure AD and Azure AD B2C.
There is no documentation found how this could be done.
As long as the web apps connect to the same identity provider/s, the user will get SSO if they visit another app and pass through those same identity providers. With AAD this is the default and only behaviour. With AAD B2C this is the default behaviour, but can be restricted.
We are using azure ad b2c for identity management and SSO for all our applications, So all our products/apps are registered on azure ad b2c directory. Users are also created on azure AD through MS Graph API. So all these users can avail the SSO facility. Now along with azure ad b2c we also want to use OneLogin. Is it possible with the existing azure ad b2c setup? I tried to google it but did not find any concrete answer. Can we add OneLogin as a identity provider like google, facebook in azure ad b2c?
Yes.
As per the docs, you can add any identity provider that supports OAuth 1.0, OAuth 2.0, OpenID Connect, or SAML protocols.
Referred the following stack overflow post Azure B2C client credentials grant
We are presently using Azure B2C.
I understand that Azure B2C does not support the client credential flow for now.
We have a requirement where an external application (server Application outside our organization) needs to access our resource (api hosted within our organization)
Is there any way we can do this from Azure AD-B2C or would we need Azure AD-B2B for these type of requirements. ?
Currently, your specific scenario -- where you are needing an access token to be issued for access by a daemon or server app to your API app -- isn't supported, however you can register the API app through the “App Registrations” blade of the Azure AD directory for your Azure AD B2C tenant.
You can upvote support for the client credentials flow by Azure AD B2C at:
https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/18529918-aadb2c-support-oauth-2-0-client-credential-flow
If the API app is to receive tokens from both a web/native app as well as the daemon/server app, then you will have to configure the API app to validate tokens from two token issuers: one being Azure AD B2C and other being the Azure AD directory for your Azure AD B2C tenant.
You should not do this anyway.
Instead, provide a portal for your customers where they can manage api keys.
Implement api keys as a second auth schema in your Api